wip: Dns bind forwarders dot#5545
Draft
bryanwieg wants to merge 8 commits into
Draft
Conversation
bryanwieg
marked this pull request as draft
July 10, 2026 19:53
Author
|
I have submitted this pr now to invite any feedback or guidance from the maintainers. I still have to create an issue, and I also am in the process of more thoroughly testing these changes in a working environment. |
bryanwieg
force-pushed
the
dns-bind-forwarders-dot
branch
2 times, most recently
from
July 14, 2026 03:31
315470c to
2c4fd3f
Compare
The primary-zone and primary-record grids shared a tab, causing the lower records grid to collapse instead of using its configured row count. This made records difficult to inspect and edit for zones with more than a few entries. Move primary records to their own tab with a full-height pane, remove the now-redundant zone filter, and add pagination. Pin only the enabled and action columns so zone names and record values can use the remaining space.
bryanwieg
force-pushed
the
dns-bind-forwarders-dot
branch
2 times, most recently
from
July 18, 2026 03:22
a63969b to
1d6e62e
Compare
Author
|
got this running on my ha setup, with a dot upstream service. so far so good. yes, I added more stuff to make it parity with unbound. please let me know if some of this is better suited for separate mr's, or other changes i need to make instead. I've made quite a few assumptions, so i welcome feedback. the commits are split per feature. |
bryanwieg
force-pushed
the
dns-bind-forwarders-dot
branch
9 times, most recently
from
July 23, 2026 21:32
ac25575 to
d795063
Compare
BIND maintained its own DNSBL definitions even though they had not been updated since 2018, while Unbound's equivalent lists continue to be maintained. Separate copies would inevitably drift. Populate the BIND DNSBL selector from Unbound's model and resolve selected shortcodes against Unbound's blocklists template at runtime. Replace the shell fetcher with a Python implementation that validates and normalizes hosts and Adblock-style entries before writing the RPZ include.
The legacy forwarder setting was a flat list of addresses, so it could not configure per-forwarder ports or BIND 9.20's native DNS-over-TLS support. It also offered no way to require forwarding rather than silently falling back to recursive resolution. Add a Forwarder model, API, dialogs, and a dedicated Forwarding page for plain DNS forwarders and DoT forwarders. Render TLS profiles with strict verification when a hostname is supplied and opportunistic TLS otherwise; combine both forwarder types in BIND's normal SRTT pool. Migrate legacy forwarders into the new model and add a General-tab Forward First/Forward Only selector that renders the corresponding BIND directive.
The plugin had no supported mechanism to publish active DHCP leases into BIND zones, and its single configuration page combined unrelated grids, which made zone, access, forwarding, and record management difficult to navigate. Add TSIG-key and watcher models, APIs, dialogs, and dedicated Access, Zones, Records, and Forwarding pages. Implement a Python watcher that polls ISC DHCP and Kea leases, persists state, and uses nsupdate with TSIG keys to maintain A, AAAA, and PTR records. Generate watcher configuration and BIND update policies, add configd lifecycle actions and logging, and expose DHCP records through a sortable API-backed grid.
Reverse zones required manual ARPA zone names and did not retain the source network needed to create correct PTR records from DHCP leases. Add a reverse domain type and source-subnet field to the domain model. Add the Reverse DNS controller, page, dialog, and API endpoints, derive reverse zone names from selected interface subnets, and render reverse domains as primary zones so the DHCP watcher can update their PTR records.
Explicit listener addresses become stale when an interface address changes and differ from Unbound's interface-based configuration. The initial implementation also left generated listener directives absent at service start. Replace the IPv4 and IPv6 listener lists with a dynamic interface selector. Migrate explicit configured addresses to their owning interfaces while preserving wildcard listeners. After template generation, render listen-on directives from the selected interfaces and loopback address, invoke that step during BIND startup, and register DNS port conflicts only for wildcard listeners.
The plugin release must identify the new forwarding, dynamic DNS, reverse zone, notification, and listener-selection functionality so package users receive the complete updated runtime tree. Set the plugin version to 1.36 with revision 1 and expand the package description to mention the added BIND capabilities.
bryanwieg
force-pushed
the
dns-bind-forwarders-dot
branch
from
July 24, 2026 15:55
d795063 to
2bcaeb8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important notices
Before you submit a pull request, we ask you kindly to acknowledge the following:
If AI was used, please disclose:
Describe the problem
BIND 9.20 supports native DNS-over-TLS forwarders with both Strict (RFC 9103) and Opportunistic TLS, but the plugin had no GUI support for configuring them. Per-forwarder destination ports were also unavailable — the legacy forwarders field was a flat CSV with no per-row configuration.
While working in this area, two other issues surfaced: the DNSBL blocklists had been unmaintained since 2018 while Unbound's equivalents are actively updated, and the primary zones/records grids had layout problems. The plugin also lacked TSIG key management and a supported way to publish DHCP leases into forward and reverse zones. Reverse zones required manual ARPA setup, listener selection differed from Unbound's interface-based model, and outgoing zone notifications could not be disabled.
Describe the proposed solution
nsupdate, persist state, and handle watcher lifecycle through configd. Split the former monolithic configuration view into dedicated Zones, Records, Access Control, and Forwarding pages.Related issue
Closes #5546